systemd.exec(5) PAMName= with libselinux

[Dominick Grift <dominick.grift@defensec.nl>]

systemd has an identity directive called PAMName= which allows you to
run a unit with a specified PAM stack. The issue here is that in this
case the "session leader" is always systemd.

Thus you get into issues with pam_selinux because since systemd is for
example always associated with "init_t" you can't really specify log
SELinux identity foo_u in with foo_r:foo_t:s0 if this PAM stack is used
and log SELinux identity foo_u in with bar_r:bar_t:s0 if that PAM stack
is used.

This previously was not a big issue since this feature is pretty niche
but with the advent of `run0` it became an issue since that relies on
PAMName=

The problem is that pam_selinux is often already used to start the
systemd --user instance, for example:

/etc/selinux/TYPE/contexts/users/foo_u (/etc/pam.d/systemd-user):
system_r:init_t:s0 foo_r:foo_systemd_user_instance_t:s0

So you can't add the following because it would conflict

/etc/selinux/TYPE/contexts/user/foo_u (/etc/pam.d/run0):
system_r:init_t:s0 foo_r:foo_shell_t:s0

Ideas? Suggestions?

-- 
gpg --locate-keys dominick.grift@defensec.nl (wkd)
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
Dominick Grift
Mastodon: @kcinimod@defensec.nl